trust-card

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/card.py, the generate/verify runtime workflow ingests free text from the outsider-authored repository directory it is pointed at (e.g., parses SKILL.md/index.md frontmatter and reads markdown/yaml across the bundle via open(...).read() in parse_frontmatter, content_provenance, and external_sources), so an attacker who can supply the directory contents can inject poison text.